There are many instances in which recording or logging an event can serve a useful purpose. This may be, for example, so that information in the logged event can be evaluated or referred to at a later date. Also, it may desirable to establish a real time of an event or the record may be used as evidence that an event actually occurred.
In the field of computer based communications systems it is also useful to maintain a record of certain events. Frequently in this environment a device or a group of devices are controlled by a management entity that is remote from the device or devices. The management entity may serve as a collector of event logs relating to the devices for which it has control. This remote management functionality can be a conduit to security threats against the access points as well as to the transmission media and to the management protocol itself. To answer this, a number of security measures can be put in place and the management protocols themselves can be made as secure as possible.
One of the security measures that has been implemented is the Syslog protocol. The Syslog process has been devised to categorize and log diverse messages and to permit rapid differentiation of notifications or messages relating to problems from notifications which relate to simple status indications.
The Syslog protocol was developed to provide a transport media to allow a machine to send event notification messages across IP networks to event message collectors which are also known as Syslog servers. The process, application and operating systems used in the Syslog protocol lack uniformity as to the content of messages. For this reason there is no attempt to format or to assure the contents of the messages. The protocol is simply designed to transport event messages to the collector where they are stored. In all cases there is one device that originates the message. The Syslog process on that machine may send the message to a collector but no acknowledgement of the receipt is made. Typically, the integrity of Syslog messages can be a critical security issue.
In an attempt to rectify this problem there have been a number of proposals to make Syslog more secure. In this regard integrity and confidentiality are both considered important however integrity is the key issue.
Syslog Sign introduces a mechanism of adding origin authentication, message integrity, replay resistance, message sequencing and detection of missing messages. Syslog Sign attempts to provide these security features in a way that has minimal requirements and minimal impact on existing Syslog implementations. Thus Syslog Sign has many key benefits and in particular the backward compatibility with existing Syslog collectors and the notion of periodic digital signatures which protect against log modification.
In addition to Syslog protocol and Syslog Sign, Reliable Syslog and BEEP are being developed. As noted above Syslog itself provides a simple protocol for event of logging but there are no security mechanism nor are there any means to provide guarantee delivery or reliability. Syslog Sign adds a level of security by providing for signed messages from the device to the server (collector). Unfortunately, there is no way for the device to verify correct receipt and there are no mechanisms to guarantee delivery.
Reliable Syslog adds a new extension to the protocol by providing a layer of reliability. Reliable Syslog suffers from two drawbacks, however, namely that it is essentially a new protocol and is not compatible with current Syslog protocols and there is no way for the device to prove that the collector received the logs correctly. BEEP only secures the transport and thus on its own is not a solution for long term verification and storage of logs.
Accordingly, there remains a need to develop an improved protocol for event logging and verification.